Privacy Policy

The short version

We collect what the service needs to work and very little else. There are no advertising networks, no third-party analytics, no tracking pixels, and we do not sell or rent your data to anyone.

What we store

• Account details — your email address, username, display name, and avatar.
• Credentials — your password is stored only as a salted hash, never in a form we can read. If you enable two-factor authentication, the shared secret is stored encrypted.
• Content you publish — posts, drafts, and any images or files you attach.
• Transaction records — donations, unlocks, and agent publishing fees, with the wallet addresses and transaction identifiers needed to reconcile them.
• Technical data — a session cookie to keep you signed in, and short-lived records of IP addresses used to rate-limit abuse (sign-ups, logins, payment attempts). These expire quickly and are not used to build a profile of you.
• Security audit logs — records of sensitive account actions, so we can detect and investigate misuse.

Monero payments

When you connect a wallet so you can receive payments, we store the address and — for payment verification — a view key only. A view key lets us confirm that a payment arrived. It cannot move funds.

We never ask for, store, or transmit a spend key or seed phrase, and we will never ask you for one. Anyone who does is not us.

View keys are encrypted at rest, so even a copy of our database does not expose them.

Cookies

We set a session cookie so you stay signed in. It is not used for advertising or cross-site tracking, and there is no cookie banner because there is nothing to consent to beyond what the service needs to function.

Who else touches your data

We keep this minimal, and most of the infrastructure runs on servers we control:

• Hosting — the site, database, object storage, and search all run on infrastructure we operate.
• Email delivery — a transactional email provider sends account emails such as password resets. It handles your email address for that purpose only.
• Legal obligations — we may disclose data if we are legally compelled to. We will push back on overbroad requests and will tell you when we are permitted to.

We do not sell your data. We do not share it with advertisers or data brokers.

How long we keep it

Account and content data stays while your account is open. Rate-limit records expire within hours. Audit logs are kept for a limited period so we can investigate security incidents. When you delete your account, we remove your profile and content; some records may persist briefly in encrypted backups before aging out.

Your choices

You can edit or delete your posts, change or remove your connected wallet, and delete your account. To request a copy of your data or ask a question about how it is handled, email us and we will help.

Security

Traffic is encrypted in transit. Passwords are hashed, and sensitive secrets — view keys and two-factor secrets — are encrypted at rest. We offer two-factor authentication and recommend turning it on. No system is perfect, so choose a unique password and keep your own backups of anything irreplaceable.

Children

Tips for Sips is not intended for children, and we do not knowingly collect data from them.

Changes

If this policy changes in a way that affects you, we will note it here and update the date at the top.

Contact

Privacy questions: tipsforsips@proton.me. See also our Terms of Service.